Why are some events not summarized in a data model?

[szabados]

I have an accelerated datamodel configured, and if I run a tstats against it, I'm getting the results as expected.
However, if I add summariesonly=t to my tstats, some I get less results. I've tried rebuilding the datamodel, at 100% the same issue happens. Can be something misconfigured, resulting in some of the events not getting summarized ?

[woodcock]

Run the Health Checks on your MC and look for skipped searches. If you have overloaded your Indexers or Search Head, you may be skipping data model acceleration searches. If so, you will have to add cores available to search ( limits.conf and datamodels.conf ) and maybe more Indexers, too. Also run your search for yesterday; do the 2 searches match for that?

[jwelch_splunk]

If you run this search for say a 1 hour window from yesterday with and without summariesonly=t do the numbers match?

If you run it with summariesonly=f for current data, it is very possible that an event that you just indexed has not yet been summarized.

Depending on how often and how long your acceleration is running there could be a big lag.